Remove module for chrome.

[people/stevee/selinux-policy.git] / policy / modules / system / userdomain.if

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 0b3811da326fbb9cfd53068d6b0233aef442d222..b523cbe02f931b4fcff22d2dc1773a9c5511b314 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -655,6 +655,8 @@ template(`userdom_common_user_template',`
        auth_read_login_records($1_usertype)
        auth_run_pam($1_t,$1_r)
        auth_run_utempter($1_t,$1_r)
+       auth_filetrans_admin_home_content($1_t)
+       auth_filetrans_home_content($1_t)
 
        init_read_utmp($1_usertype)
 
@@ -685,10 +687,6 @@ template(`userdom_common_user_template',`
                canna_stream_connect($1_usertype)
        ')
 
-       optional_policy(`
-               chrome_role($1_r, $1_usertype)
-       ')
-
        optional_policy(`
                colord_read_lib_files($1_usertype)
        ')
@@ -786,10 +784,6 @@ template(`userdom_common_user_template',`
                mta_filetrans_home_content($1_usertype)
        ')
 
-       optional_policy(`
-               nsplugin_role($1_r, $1_usertype)
-       ')
-
        optional_policy(`
                tunable_policy(`allow_user_mysql_connect',`
                        mysql_stream_connect($1_t)
@@ -3967,6 +3961,38 @@ template(`userdom_unpriv_usertype',`
        ubac_constrained($2)
 ')
 
+#######################################
+## <summary>
+##  Define this type as a Allow apps to set rlimits on userdomain
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+## <param name="userdomain_prefix">
+##  <summary>
+##  The prefix of the user domain (e.g., user
+##  is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+template(`userdom_unpriv_type',`
+    gen_require(`
+        attribute unpriv_userdomain, userdomain;
+    ')
+    typeattribute $2  unpriv_userdomain;
+    typeattribute $2  userdomain;
+
+    auth_use_nsswitch($2)
+    ubac_constrained($2)
+')
+
 ########################################
 ## <summary>
 ##     Connect to users over an unix stream socket.
@@ -4172,6 +4198,25 @@ interface(`userdom_read_admin_home_files',`
        read_files_pattern($1, admin_home_t, admin_home_t)
 ')
 
+########################################
+## <summary>
+##     Delete admin home files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <rolecap/>
+#
+interface(`userdom_delete_admin_home_files',`
+       gen_require(`
+               type admin_home_t;
+       ')
+
+       allow $1 admin_home_t:file delete_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Execute admin home files.
@@ -5096,4 +5141,3 @@ interface(`userdom_home_manager',`
 
        typeattribute $1 userdom_home_manager_type;
 ')
-